What is TSS Webcam?
The Malwarebytes research team has determined that TSS Webcam is a Tech Support Scam. These so-called "Tech Support Scammers" try to trick you into calling their phone number for various reasons, all of which turn out to be fraudulent in the end.
How do I know if my computer is affected by TSS Webcam?
During install you may see this warning:
You will see this screen when the system reboots:
and this prompt on top of it:
How did TSS Webcam get on my computer?
Tech Support Scammers use different methods for distributing themselves. This particular one was downloaded by another Tech Support Scam.
How do I remove TSS Webcam?
Our program Malwarebytes Anti-Malware can detect and remove this potentially unwanted application, but due to the nature of the infection this will require lsome extra steps.
- Note that the password for the prompt is 6320DDC8F7F0DF93FAA1FF46DBBE329BD333A28A, but it will almost certainly require several tries.
- Once you succeed, the text field of the prompt will be greyed out, then you can use Ctr-Alt-Del to access Taskmanager.
- End the processes called bsod.exe, MSEAlert.exe, track.exe, and wu.exe. Then use Taskmanager to Run explorer.
- Then continue with the instructions below.
- Please download Malwarebytes Anti-Malware to your desktop.
- Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
- Then click Finish.
- Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
- If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
- When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
- Restart your computer when prompted to do so.
Is there anything else I need to do to get rid of TSS Webcam?
- No, Malwarebytes' Anti-Malware removes TSS Webcam completely.
We hope our application and this guide have helped you eradicate this hijacker.
As you can see below the full version of Malwarebytes Anti-Malware would have protected you against the Tech Supprt Scam.
Technical details for experts
You may see these entries in FRST logs:
HKLM-x32\...\Run: [L] => C:\Windows\wu.exe HKLM-x32\...\Winlogon: [Shell] C:\Windows\bsod.exe [ ] () <=== ATTENTION HKCU\...\Run: [L] => C:\Windows\wu.exe [820373 2016-11-28] (wu) HKCU\...\Winlogon: [Shell] C:\Windows\bsod.exe [24576 2016-11-28] () <==== ATTENTION C:\Windows\ClearLock.ini C:\Users\Public\Desktop\WebCam.lnk C:\Windows\bsod.exe C:\Windows\track.exe (wu) C:\Windows\wu.exe C:\Windows\mse.bat C:\Windows\MSEAlert.exeAlterations made by the installer:
File system details [View: All details] (Selection)
---------------------------------------------------
Adds the folder C:\Program Files (x86)\Webcam\Webcam
Adds the file WebCam.exe"="11/9/2016 3:12 PM, 106496 bytes, A
Adds the folder C:\Users\{username}\AppData\Roaming\Webcam\Webcam 4.0.0.0\install\CA4339E
Adds the file Webcam.msi"="11/28/2016 7:49 PM, 1603584 bytes, A
In the existing folder C:\Users\Public\Desktop
Adds the file WebCam.lnk"="12/15/2016 8:59 AM, 1024 bytes, A
In the existing folder C:\Windows
Adds the file bsod.exe"="11/28/2016 7:34 PM, 24576 bytes, A
Adds the file ClearLock.ini"="12/15/2016 8:59 AM, 30 bytes, A
Adds the file mse.bat"="11/28/2016 6:21 PM, 49 bytes, A
Adds the file MSEAlert.exe"="11/24/2016 3:14 AM, 28672 bytes, A
Adds the file track.exe"="11/28/2016 7:26 PM, 20480 bytes, A
Adds the file wu.exe"="11/28/2016 7:14 PM, 820373 bytes, A
Registry details [View: All details] (Selection)
------------------------------------------------
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders]
"C:\Program Files (x86)\Webcam\"="REG_SZ", ""
"C:\Program Files (x86)\Webcam\Webcam\"="REG_SZ", ""
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Caphyon\Advanced Installer\LZMA\{5D4F78D0-3E89-4F45-A6FF-5C6ACCA4339E}\4.0.0.0]
"AI_ExePath"="REG_SZ", "C:\Users\{username}\Desktop\windows_update.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"L"="REG_SZ", "C:\Windows\wu.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon]
"LegalNoticeCaption"="REG_SZ", "Windows Firewall Warning!"
"LegalNoticeText"="REG_SZ", "You might be infected with adware / spyware virus. Call 1-800-935-6918 immediately. Fast assistance with removing viruses. (Toll-FREE 1-800-935-6918, High Priority Call Line). Seeing these pop-ups means that you may have a virus installed on your computer which puts the security of your personal data at a serious risk. Its strongly advised that you call the number above and get your computer fixed before you continue using your internet, especially for shopping. Possible Privacy Breach if virus not removed immediately: Data exposed to risk: 1. Your credit card details and banking information. 2. Your e-mail passwords and other account passwords. 3. Your Facebook, Skype, AIM, ICQ and other chat logs. 4. Your private photos, family photos and other sensitive files. 5. Your webcam could be accessed remotely by stalkers with a VPN virus. (Toll-FREE 1-800-935-6918, High Priority Call Line)"
"Shell" = REG_SZ, "C:\Windows\bsod.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Webcam\{5D4F78D0-3E89-4F45-A6FF-5C6ACCA4339E}]
"AI_IA_ENABLE"="REG_SZ", "1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Webcam\Webcam]
"Path"="REG_SZ", "C:\Program Files (x86)\Webcam\Webcam\"
"Version"="REG_SZ", "4.0.0.0"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"L"="REG_SZ", "C:\Windows\wu.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="REG_SZ", "C:\Windows\bsod.exe"
Malwarebytes Anti-Malware log:Malwarebytes
www.malwarebytes.com
-Log Details-
Scan Date: 12/15/16
Scan Time: 9:33 AM
Logfile: mbamTSSWebcam.txt
Administrator: Yes
-Software Information-
Version: 3.0.4.1269
Components Version: 1.0.39
Update Package Version: 1.0.742
License: Premium
-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: {computername}\{username}
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 351642
Time Elapsed: 8 min, 14 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
-Scan Details-
Process: 0
(No malicious items detected)
Module: 0
(No malicious items detected)
Registry Key: 0
(No malicious items detected)
Registry Value: 5
Trojan.LockScreen, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|L, Delete-on-Reboot, [163], [353073],1.0.742
Trojan.LockScreen, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|L, Delete-on-Reboot, [163], [353073],1.0.742
Trojan.LockScreen, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON|Shell, Replace-on-Reboot, [163], [353067],1.0.742
Hijack.Shell, HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON|SHELL, Delete-on-Reboot, [625], [353061],1.0.742
Hijack.Shell, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON|SHELL, Replace-on-Reboot, [625], [353062],1.0.742
Data Stream: 0
(No malicious items detected)
Folder: 0
(No malicious items detected)
File: 5
Trojan.LockScreen, C:\WINDOWS\WU.EXE, Delete-on-Reboot, [163], [353073],1.0.742
Trojan.LockScreen, C:\USERS\{username}\DESKTOP\WINDOWS_UPDATE.EXE, Delete-on-Reboot, [163], [353030],1.0.742
Trojan.LockScreen, C:\WINDOWS\TRACK.EXE, Delete-on-Reboot, [163], [353071],1.0.742
Trojan.LockScreen, C:\WINDOWS\MSEALERT.EXE, Delete-on-Reboot, [163], [353070],1.0.742
Trojan.LockScreen, C:\WINDOWS\BSOD.EXE, Delete-on-Reboot, [163], [353067],1.0.742
Physical Sector: 0
(No malicious items detected)
(end)As mentioned before the full version of Malwarebytes Anti-Malware could have protected your computer against this threat.We use different ways of protecting your computer(s):
- Dynamically Blocks Malware Sites & Servers
- Malware Execution Prevention
Back to top
Sign In
Create Account
